Reworked patch for labels on user space messages

PATCH Steve Grubb 2 participants 3 messages Apr 1, 2006 – Apr 3, 2006

Subsystems (3)

Networking SELinux security module Audit

lore

Share & tools

lore

Steve Grubb

author

2006-04-01 15:02 UTC #0 lore raw

Hi,

The below patch should be applied after the inode and ipc sid patches. This patch is a reworking of Tim's patch that has been updated to match the inode and ipc patches since its similar.

Signed-off-by Steve Grubb <[email protected]>

include/linux/netlink.h +1 -0

diff -urp linux-2.6.16.x86_64.orig/include/linux/netlink.h linux-2.6.16.x86_64/include/linux/netlink.h
@@ -143,6 +143,7 @@ struct netlink_skb_parms
 	__u32			dst_group;
 	kernel_cap_t		eff_cap;
 	__u32			loginuid;	/* Login (audit) uid */
+	__u32			sid;		/* SELinux security id */
 };
 
 #define NETLINK_CB(skb)		(*(struct netlink_skb_parms*)&((skb)->cb))

include/linux/selinux.h +16 -0

diff -urp linux-2.6.16.x86_64.orig/include/linux/selinux.h linux-2.6.16.x86_64/include/linux/selinux.h
@@ -5,6 +5,7 @@
  *
  * Copyright (C) 2005 Red Hat, Inc., James Morris <[email protected]>
  * Copyright (C) 2006 Trusted Computer Solutions, Inc. <[email protected]>
+ * Copyright (C) 2006 IBM Corporation, Timothy R. Chavez <[email protected]>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2,

@@ -108,6 +109,16 @@ void selinux_get_inode_sid(const struct 
  */
 void selinux_get_ipc_sid(const struct kern_ipc_perm *ipcp, u32 *sid);
 
+/**
+ *     selinux_get_task_sid - return the SID of task
+ *     @tsk: the task whose SID will be returned
+ *     @sid: pointer to security context ID to be filled in.
+ *
+ *     Returns nothing
+ */
+void selinux_get_task_sid(struct task_struct *tsk, u32 *sid);
+
+
 #else
 
 static inline int selinux_audit_rule_init(u32 field, u32 op,

@@ -156,6 +167,11 @@ static inline void selinux_get_ipc_sid(c
 	*sid = 0;
 }
 
+static inline void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
+{
+	*sid = 0;
+}
+
 #endif	/* CONFIG_SECURITY_SELINUX */
 
 #endif /* _LINUX_SELINUX_H */

kernel/audit.c +19 -3

diff -urp linux-2.6.16.x86_64.orig/kernel/audit.c linux-2.6.16.x86_64/kernel/audit.c
@@ -389,7 +389,7 @@ static int audit_netlink_ok(kernel_cap_t
 
 static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 {
-	u32			uid, pid, seq;
+	u32			uid, pid, seq, sid;
 	void			*data;
 	struct audit_status	*status_get, status_set;
 	int			err;

@@ -415,6 +415,7 @@ static int audit_receive_msg(struct sk_b
 	pid  = NETLINK_CREDS(skb)->pid;
 	uid  = NETLINK_CREDS(skb)->uid;
 	loginuid = NETLINK_CB(skb).loginuid;
+	sid  = NETLINK_CB(skb).sid;
 	seq  = nlh->nlmsg_seq;
 	data = NLMSG_DATA(nlh);

@@ -467,8 +468,23 @@ static int audit_receive_msg(struct sk_b
 			ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
 			if (ab) {
 				audit_log_format(ab,
-						 "user pid=%d uid=%u auid=%u msg='%.1024s'",
-						 pid, uid, loginuid, (char *)data);
+						 "user pid=%d uid=%u auid=%u",
+						 pid, uid, loginuid);
+				if (sid) {
+					char *ctx = NULL;
+					u32 len;
+					if (selinux_ctxid_to_string(
+							sid, &ctx, &len)) {
+						audit_log_format(ab, 
+							" subj=%u", sid);
+						/* Maybe call audit_panic? */
+					} else
+						audit_log_format(ab, 
+							" subj=%s", ctx);
+					kfree(ctx);
+				}
+				audit_log_format(ab, " msg='%.1024s'",
+					 (char *)data);
 				audit_set_pid(ab, pid);
 				audit_log_end(ab);
 			}

net/netlink/af_netlink.c +2 -0

diff -urp linux-2.6.16.x86_64.orig/net/netlink/af_netlink.c linux-2.6.16.x86_64/net/netlink/af_netlink.c
@@ -56,6 +56,7 @@
 #include <linux/mm.h>
 #include <linux/types.h>
 #include <linux/audit.h>
+#include <linux/selinux.h>
 
 #include <net/sock.h>
 #include <net/scm.h>

@@ -1122,6 +1123,7 @@ static int netlink_sendmsg(struct kiocb 
 	NETLINK_CB(skb).dst_pid = dst_pid;
 	NETLINK_CB(skb).dst_group = dst_group;
 	NETLINK_CB(skb).loginuid = audit_get_loginuid(current->audit_context);
+	selinux_get_task_sid(current, &(NETLINK_CB(skb).sid));
 	memcpy(NETLINK_CREDS(skb), &siocb->scm->creds, sizeof(struct ucred));
 
 	/* What can I do? Netlink is asynchronous, so that

security/selinux/exports.c +11 -0

diff -urp linux-2.6.16.x86_64.orig/security/selinux/exports.c linux-2.6.16.x86_64/security/selinux/exports.c
@@ -5,6 +5,7 @@
  *
  * Copyright (C) 2005 Red Hat, Inc., James Morris <[email protected]>
  * Copyright (C) 2006 Trusted Computer Solutions, Inc. <[email protected]>
+ * Copyright (C) 2006 IBM Corporation, Timothy R. Chavez <[email protected]>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2,

@@ -61,3 +62,13 @@ void selinux_get_ipc_sid(const struct ke
 	*sid = 0;
 }
 
+void selinux_get_task_sid(struct task_struct *tsk, u32 *sid)
+{
+	if (selinux_enabled) {
+		struct task_security_struct *isec = tsk->security;
+		*sid = isec->sid;
+		return;
+	}
+	*sid = 0;
+}
+

Timothy R. Chavez

2006-04-03 06:25 UTC #1 lore raw

Quoted 6 lines · Steve Grubb

Hi,
The below patch should be applied after the inode and ipc sid patches. This patch is a reworking of Tim's patch that has been updated to match the inode and ipc patches since its similar.

Steve,

Hey thanks for doing this. I have just one comment below.

-tim

include/linux/netlink.h struct netlink_skb_parms · line 146

Quoted 11 lines

Signed-off-by Steve Grubb <[email protected]>
diff -urp linux-2.6.16.x86_64.orig/include/linux/netlink.h linux-2.6.16.x86_64/include/linux/netlink.h
include/linux/netlink.h +1 -0
@@ -143,6 +143,7 @@ struct netlink_skb_parms
 	__u32			dst_group;
 	kernel_cap_t		eff_cap;
 	__u32			loginuid;	/* Login (audit) uid */
+	__u32			sid;		/* SELinux security id */

I think we agreed not to call this 'sid' as that has another meaning (namely "session id") outside of SELinux.

Steve Grubb

author

2006-04-03 13:08 UTC #2 lore raw

Quoted 11 lines · Timothy R. Chavez

Quoted 3 lines · Steve Grubb
The below patch should be applied after the inode and ipc sid patches. This patch is a reworking of Tim's patch that has been updated to match the inode and ipc patches since its similar.
Hey thanks for doing this. I have just one comment below.
+ __u32 sid; /* SELinux security id */
I think we agreed not to call this 'sid' as that has another meaning (namely "session id") outside of SELinux.

Yeah...right...updated patch below.